4 files changed, 20 insertions, 7 deletions

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 85a6f66a873f..62b963aca275 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -242,7 +242,7 @@ void __init avc_init(void)
         avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
                                              0, SLAB_PANIC, NULL, NULL);
 
-        audit_log(current->audit_context, "AVC INITIALIZED\n");
+        audit_log(current->audit_context, AUDIT_KERNEL, "AVC INITIALIZED\n");
 }
 
 int avc_get_hash_stats(char *page)
@@ -532,6 +532,7 @@ void avc_audit(u32 ssid, u32 tsid,
                u16 tclass, u32 requested,
                struct av_decision *avd, int result, struct avc_audit_data *a)
 {
+        struct task_struct *tsk = current;
         struct inode *inode = NULL;
         u32 denied, audited;
         struct audit_buffer *ab;
@@ -549,12 +550,18 @@ void avc_audit(u32 ssid, u32 tsid,
                         return;
         }
 
-        ab = audit_log_start(current->audit_context);
+        ab = audit_log_start(current->audit_context, AUDIT_AVC);
         if (!ab)
                 return;         /* audit_panic has been called */
         audit_log_format(ab, "avc:  %s ", denied ? "denied" : "granted");
         avc_dump_av(ab, tclass,audited);
         audit_log_format(ab, " for ");
+        if (a && a->tsk)
+                tsk = a->tsk;
+        if (a->tsk && a->tsk->pid) {
+                audit_log_format(ab, " pid=%d comm=", tsk->pid);
+                audit_log_untrustedstring(ab, tsk->comm);
+        }
         if (a) {
                 switch (a->type) {
                 case AVC_AUDIT_DATA_IPC:
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index aae1e794fe48..db845cbd5841 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3419,7 +3419,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
         if (err) {
                 if (err == -EINVAL) {
-                        audit_log(current->audit_context,
+                        audit_log(current->audit_context, AUDIT_SELINUX_ERR,
                                   "SELinux:  unrecognized netlink message"
                                   " type=%hu for sclass=%hu\n",
                                   nlh->nlmsg_type, isec->sclass);
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index b3adb481bc25..f0fb6d76f7c5 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -97,6 +97,7 @@ static struct nlmsg_perm nlmsg_audit_perms[] =
         { AUDIT_ADD,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
         { AUDIT_DEL,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
         { AUDIT_USER,           NETLINK_AUDIT_SOCKET__NLMSG_RELAY    },
+        { AUDIT_SIGNAL_INFO,    NETLINK_AUDIT_SOCKET__NLMSG_READ     },
 };
 
 
@@ -141,8 +142,13 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
                 break;
 
         case SECCLASS_NETLINK_AUDIT_SOCKET:
-                err = nlmsg_perm(nlmsg_type, perm, nlmsg_audit_perms,
-                                 sizeof(nlmsg_audit_perms));
+                if (nlmsg_type >= AUDIT_FIRST_USER_MSG &&
+                    nlmsg_type <= AUDIT_LAST_USER_MSG) {
+                        *perm = NETLINK_AUDIT_SOCKET__NLMSG_RELAY;
+                } else {
+                        err = nlmsg_perm(nlmsg_type, perm, nlmsg_audit_perms,
+                                         sizeof(nlmsg_audit_perms));
+                }
                 break;
 
         /* No messaging from userspace, or class unknown/unhandled */
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 8449d667b062..b6149147d5cb 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -365,7 +365,7 @@ static int security_validtrans_handle_fail(struct context *ocontext,
                 goto out;
         if (context_struct_to_string(tcontext, &t, &tlen) < 0)
                 goto out;
-        audit_log(current->audit_context,
+        audit_log(current->audit_context, AUDIT_SELINUX_ERR,
                   "security_validate_transition:  denied for"
                   " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
                   o, n, t, policydb.p_class_val_to_name[tclass-1]);
@@ -742,7 +742,7 @@ static int compute_sid_handle_invalid_context(
                 goto out;
         if (context_struct_to_string(newcontext, &n, &nlen) < 0)
                 goto out;
-        audit_log(current->audit_context,
+        audit_log(current->audit_context, AUDIT_SELINUX_ERR,
                   "security_compute_sid:  invalid context %s"
                   " for scontext=%s"
                   " tcontext=%s"